Description
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-03-12
Score: 8.8 High
EPSS: 2.7% Low
KEV: Yes
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an inappropriate implementation in the V8 JavaScript engine used by Google Chrome. It allows a remote attacker to execute arbitrary code inside the browser sandbox by delivering a specially crafted HTML page. The flaw is identified as a buffer overflow (CWE-119) and a code injection vulnerability (CWE-94), highlighting critical issues with memory handling and input validation within the engine.

Affected Systems

All versions of Google Chrome older than 146.0.7680.75 are affected. The issue impacts every operating system that can run Chrome, including Windows, macOS, and Linux, as indicated by the product availability on these platforms.

Risk and Exploitability

The CVSS score of 8.8 classifies the vulnerability as high severity. A low EPSS score of 3 % indicates that the likelihood of exploitation is modest, yet the vulnerability is listed in CISA’s KEV catalog, confirming real-world exploits. Based on the description, the attack requires a user or attacker to open or load a maliciously crafted HTML page in an affected Chrome instance; no further privileges are necessary to trigger the flaw.

Generated by OpenCVE AI on October 25, 2026 at 21:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 146.0.7680.75 or newer.
  • Until the update can be applied, temporarily disable JavaScript in Chrome by navigating to chrome://flags and setting "JavaScript" to "Disabled" or by using an extension that blocks scripts.
  • Avoid opening or viewing untrusted HTML files or visiting suspicious web sites in Chrome until the patch is installed.

Generated by OpenCVE AI on October 25, 2026 at 21:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6165-1 chromium security update
History

Fri, 13 Mar 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
Weaknesses CWE-94
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Fri, 13 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 13 Mar 2026 17:00:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-03-13T00:00:00+00:00', 'dueDate': '2026-03-27T00:00:00+00:00'}

Fri, 13 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Fri, 13 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Inappropriate implementation in V8
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 13 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 12 Mar 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 12 Mar 2026 21:45:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-03-14T03:55:26.662Z

Reserved: 2026-03-11T00:54:21.991Z

Link: CVE-2026-3910

cve-icon Vulnrichment

Updated: 2026-03-12T22:08:41.096Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-13T19:55:11.363

Modified: 2026-06-17T10:44:24.517

Link: CVE-2026-3910

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-12T00:00:00Z

Links: CVE-2026-3910 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-25T22:00:15Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')